Limit admin API and GUI

[Trapulo]

Is there any way to limit access to admin GUI panel only, leaving agents allowed to connect from anywhere?
Basically I want to restrict IP address allowed to access the admin API and panel to protect it.

I have a reverse proxy as frontend and I can limit some path, but I cannot understand the right way.

thanks

[silversword411]

https://discord.com/channels/736478043522072608/889513877124042762/1353759259019575369

Restricting the frontend doesn't add any security. Everything happens on the API subdomain. You can see this by interacting with RMM while watching your browsers dev tools (Assuming I was a malicious actor). I could deploy my own copy of the frontend and point it at your API endpoint. Or just make API calls directly
also
rmm url is just a frontend app that talks to your api to do everything. You restricting RMM doesn't stop others, just raises the bar on technical skills required to try and use it.

[silversword411]

I think this will restrict admin's access, doesn't it?

No

[Trapulo]

So, where are admin APIs and where are agents APIs?

[silversword411]

API.yourdomain.com

[Trapulo]

I know this. But are both mixed? I hope there is some path in HTTP urls where there are admin APIs, and a specific path where there are agents APIs (eg. API.yourdomain.com/agents, that I know is not existent).

[wh1te909]

there are separate paths, but not currently documented.